> For the complete documentation index, see [llms.txt](https://docs.carto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.carto.com/carto-for-agents/connect-your-platform/snowflake-cortex.md).

# Snowflake Cortex

Snowflake connects to CARTO as an **external MCP server** attached to a Cortex agent. You can set it up from the Snowsight UI or with SQL, both produce the same objects. Snowflake's external MCP support is first-class and CARTO runs in production there.

## Requirements

* **ACCOUNTADMIN** on the Snowflake account.
* Your CARTO **MCP Server URL**.
* A CARTO **SPA OAuth Client** — it must be **confidential** (have a Client Secret). Snowflake's rejects a public/PKCE-only client, and static API tokens aren't supported here.

Before you start, register Snowflake's fixed callback on your CARTO client so no round trip is needed: open the SPA client in CARTO, turn off **"Use default logout/callback URLs and Origins"**, and add:

```
https://identity.snowflake.com/oauth2/callback
```

## Install

### 1. Create the MCP Connector

#### Snowsight UI

Go to **Settings > MCP connectors > Add MCP Connector**

<figure><img src="/files/Pt0inMjRSwsWKPFPOx2X" alt=""><figcaption></figcaption></figure>

Fill in:

<table data-search="false"><thead><tr><th>Field</th><th>Value</th></tr></thead><tbody><tr><td>Location</td><td>A real database and schema.</td></tr><tr><td>Name</td><td>Anything, for example <code>carto_mcp_server</code></td></tr><tr><td>Description</td><td>What the connector si for – Snowflake shows this to the agent</td></tr><tr><td>API Integration</td><td>Standard OAuth</td></tr><tr><td>Server URL</td><td>Your <a href="/pages/2qEL0xe1jvf2yfQjMRtx">MCP Server URL</a></td></tr><tr><td>Authorization endpoint</td><td><code>https://auth.carto.com/authorize</code></td></tr><tr><td>Token endpoint</td><td><code>https://auth.carto.com/oauth/token</code></td></tr><tr><td>OAuth Client ID/Secret</td><td>From your SPA client</td></tr><tr><td>Scopes</td><td><code>openid,profile,email,read:workflows,write:workflows</code></td></tr></tbody></table>

{% hint style="info" %}
**Don't use the Dynamic Client Registration (DCR) tab**. CARTO disables dynamic client registration, so that path fails. Always choose **Standard OAuth** and enter the values by and.
{% endhint %}

#### SQL

All SQL below runs as **ACCOUNTADMIN**.

```sql
CREATE API INTEGRATION CARTO_MCP_OAUTH2
  API_PROVIDER = external_mcp
  API_ALLOWED_PREFIXES = ('https://<region>.api.carto.com')
  API_USER_AUTHENTICATION = (
    TYPE = OAUTH2
    OAUTH_GRANT = AUTHORIZATION_CODE
    OAUTH_CLIENT_ID = '<your SPA client id>'
    OAUTH_CLIENT_SECRET = '<your SPA client secret>'
    OAUTH_TOKEN_ENDPOINT = 'https://auth.carto.com/oauth/token'
    OAUTH_AUTHORIZATION_ENDPOINT = 'https://auth.carto.com/authorize'
    OAUTH_CLIENT_AUTH_METHOD = CLIENT_SECRET_BASIC
    OAUTH_ALLOWED_SCOPES = ('openid','profile','email','read:workflows','write:workflows'))
  ENABLED = TRUE;
```

```sql
CREATE EXTERNAL MCP SERVER CARTO_MCP_SERVER
  WITH DISPLAY_NAME = 'CARTO MCP'
  URL = 'https://<region>.api.carto.com/mcp/<account_id>'
  API_INTEGRATION = CARTO_MCP_OAUTH2;
```

{% hint style="info" %}
`OAUTH_GRANT = AUTHORIZATION_CODE` is required — a CARTO SPA client is an authorization-code client. `CREATE OR REPLACE` isn't allowed for this integration type; to change it, `DROP` then `CREATE`.
{% endhint %}

### **3. Grant access**

The role that builds and uses the agent needs `USAGE` on four objects: the **API integration**, the **external MCP server**, and the **database** and **schema** that contain it. Without them, the agent is created normally and only fails when someone runs it, with an "Insufficient privileges to operate on Integration" error.

If you created the connector in the UI, look up the generated integration name first — it's derived from the connector name:

```sql
SHOW EXTERNAL MCP SERVERS;
```

Then, as ACCOUNTADMIN:

```sql
GRANT USAGE ON INTEGRATION CARTO_MCP_OAUTH2 TO ROLE <agent_dev_role>;
GRANT USAGE ON EXTERNAL MCP SERVER CARTO_MCP_SERVER TO ROLE <agent_dev_role>;
GRANT USAGE ON DATABASE <db> TO ROLE <agent_role>;
GRANT USAGE ON SCHEMA <db>.<schema> TO ROLE <agent_role>;
```

You can also grant roles on the agent itself from its **Access** tab.

**4. Attach it to an agent**

In Snowsight: **Agents** > open your agent > **Configuration** > **MCP** > **Add to agent**. Then complete the CoWork "Connect" consent — it signs you in to CARTO.

{% hint style="warning" %}
Snowflake creates the objects even with invalid credentials — the integration reports healthy, and the failure only surfaces when someone runs the agent. **Always test with a real agent run** before declaring the setup finished. Snowflake never displays an MCP tool inventory, so verify by asking the agent what it can do.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.carto.com/carto-for-agents/connect-your-platform/snowflake-cortex.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.